MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b26f5c66365dc4317d807877eb40ea79b30a7067de886512c6050c9f1310d63a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b26f5c66365dc4317d807877eb40ea79b30a7067de886512c6050c9f1310d63a
SHA3-384 hash: 7d6a6af90e5d6cdf52a8f37db44b6b49ea9ee847813fbdd2c1e88913b0e6a86682f313811578115846780529d31dc1bf
SHA1 hash: 75b4a57a9b82e8ee181769a9d2a1ef84c998c68d
MD5 hash: e95ece3812c9a4b22e06dfc979ae8501
humanhash: lima-skylark-mobile-salami
File name:Quotation Referance_2020_16_7.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-07-16 19:07:24 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:HbXC3AVk4zUOeX5T03UBBhrsBj6xqwgztl5pbt920mzXll2p7rWJ7Ud:Hbq2k4zUrp77KrwUu0mzXll2pne7
TLSH 78458BE83EE25911C5FE8EBA4CA1ED3049287DC6F4F1A26A77CCEE4F3271240D859159
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vps.rajo.com.br
Sending IP: 162.241.40.68
From: Christain Medrano <contato@cienciasociedade.org>
Subject: RFQ_1832392349
Attachment: Quotation Referance_2020_16_7.img (contains "Quotation Referance_2020_16_7.exe")

AgentTesla SMTP exfil server:
mail.makezimbetter.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CAP_HookExKeylogger.21298.10914.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b26f5c66365dc4317d807877eb40ea79b30a7067de886512c6050c9f1310d63a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-16 19:09:05 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wjxvyzrwlxcdc7mapb36wqhkpgzqu4dh32egkewgaugj6eyq2y5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img b26f5c66365dc4317d807877eb40ea79b30a7067de886512c6050c9f1310d63a

(this sample)

AgentTesla

Executable exe 0d6824a76cdb66150361c039b10e1fe5eb109b7bf6131f825186f537b5d8e497

  
Dropping
MD5 347552f16085097b8311621b034722ed
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0d6824a76cdb66150361c039b10e1fe5eb109b7bf6131f825186f537b5d8e497

Comments